RISK MANAGEMENT. In order to achieve our risk management objectives, we have undertaken various initiatives in the past several years, including:

Transcription

1 OVERVIEW The primary risks we face are credit risk, market risk (including interest and exchange rate risks), liquidity risk and operational risk (including legal and compliance risks). We are also exposed to strategic risk and reputation risk. We seek to maintain a moderate risk appetite and a balance between risk and return in a rational, stable and prudent manner. Our primary risk management goals are to maximize value for our shareholders within acceptable risk parameters and satisfy the requirements of the Board of Directors, the relevant regulatory authorities, our depositors and other interest groups for our bank's prudent and stable development. The guiding principles in developing our risk management framework include: (1) complying with legal and regulatory requirements; (2) achieving an appropriate equilibrium between risk and return; (3) achieving and maintaining the independence of our risk management function; (4) holding responsible employees accountable; (5) aligning risk management and business development objectives; and (6) providing appropriate disclosure. Through our ongoing eåorts to develop and enhance our risk management framework, we seek to achieve the following objectives: (1) extending our risk management framework to all of our business departments, branches and subsidiaries; (2) ensuring that risks inherent in our various lines of business are eåectively managed; (3) establishing a pervasive risk management culture; (4) developing comprehensive and integrated risk management procedures, policies and processes; and (5) utilizing appropriate risk management tools to identify, monitor and quantify our risks. In order to achieve our risk management objectives, we have undertaken various initiatives in the past several years, including: improving the independence and organizational structure of our risk management function: in 1999, we established an independent risk management department to monitor and manage credit risk; in 2001, we established non-performing asset management departments to collect, dispose and manage non-performing assets; in September 2004, we established a risk policy committee to assist our Board of Directors in risk management; in November 2004, we restructured our non-performing asset management departments into credit administration departments to control the disbursement of funds and manage certain non-performing loans; and in September 2005, we approved a new framework to strengthen the independence of the market risk management in accordance with CBRC rules and regulations; increasing centralized risk management supervision and monitoring at our domestic branches: in July 2004, we began establishing more stringent and uniform qualiñcation standards for the general managers of the risk management departments at our domestic tier one branches; since 2004, our new corporate loans are required to be approved at either our domestic tier one branches or our head oçce, and this policy has been extended to cover the renewal of existing corporate loans in 2005; 167

2 since 2005, we have centralized personal loan approvals at our domestic tier one branches; in September 2004, we initiated a credit approval veriñcation procedure whereby the risk management department at our head oçce veriñes, analyzes and monitors the corporate lending decisions at our domestic branches; since 2005, any assignment of a ""B'' or higher credit rating under our ten-category customer rating system is required to be approved either at our domestic tier one branches or our head oçce, as applicable; since the second quarter of 2005, we have enhanced the criteria for loan classiñcations and built a team that specializes in classifying loans; and since the second quarter of 2005, we have centralized the review and approval of the classiñcation of our corporate loans at the risk management departments of our head oçce and domestic tier one branches; improving our management and assessment of credit risk: in 1999, we began using a ten-category customer rating system for our corporate customers; in 1999, we began implementing the Ñve-category loan classiñcation system adopted by the PBOC to evaluate the credit risk associated with our corporate loans; in 1999, we began instituting integrated credit risk management of our corporate and Ñnancial institutional lending, retail lending, trade Ñnance and treasury operations; in 2000, we began implementing a ""three-in-one'' credit approval process for corporate loans, which consists of an independent due diligence investigation, an assessment by an independent credit review committee, and a credit extension decision by separate authorized credit application approvers; and in 2004, we began assessing loans for impairment under IFRS; and improving our risk monitoring and risk alert system: in 2002, we began implementing a credit management information system to monitor our corporate lending and collect information on customers, loan agreements, risk classiñcation and accounting treatment relating to domestic corporate lending; in 2003, we established a major risk event reporting system requiring major risk events to be reported to the risk management department at our head oçce; and in 2004, we began implementing an asset quality monitoring system to collect and analyze data on our outstanding domestic corporate loans and monitor our credit risk. Although some of these initiatives have been implemented only recently and partially and their eåectiveness has not been tested, we believe the implementation of these initiatives will increase the eåectiveness of our risk management and improve our asset quality over time. For a description of certain risks applicable to our asset quality, see ""Risk Factors Risks Relating to Our Loan Portfolio''. 168

3 RISK MANAGEMENT STRUCTURE The chart below illustrates the organizational structure of the principal elements of our risk management framework. Board of Directors Board Level Risk Policy Committee Internal Control Committee Senior Management President (1) Anti-Money Laundering Working Committee Asset-Liability Management Committee Asset Disposal Committee (2) Chief Credit Officer Risk Management Related Departments Operational Risk Credit Risk Market Risk Liquidity Risk Legal and Compliance Department Risk Management Department and Credit Administration Department Risk Management Department (3) Asset-Liability Management Department Participation at the board of directors Vertical control Task forces and vertical control Risk Management at our Business Departments, Branches and Subsidiaries Subsidiaries Domestic Overseas subsidiaries subsidiaries Branches Domestic Overseas branches branches Business Departments Business departments at our head office (1) Some management decisions are made in the Presidents' meetings organized by our President with our Vice Presidents, Assistant Presidents and Chief Credit OÇcer. See "" Senior Management and Special Management Committees''. (2) Our current Chief Credit OÇcer, Lonnie Dounn, has tendered his resignation notice and will resign from this position in September (3) We are in the process of integrating the market risk management function into the risk management department. Currently market risk is primarily managed by our global markets and asset-liability management departments. 169

4 Board of Directors and Risk Policy Committee The Board of Directors is responsible for establishing our overall risk appetite and reviewing and approving our risk management objectives and strategies. The primary responsibilities of our risk policy committee include assessing and monitoring the implementation of our risk management and internal control policies, including credit policies, monitoring the exposure against established parameters, monitoring and evaluating our risk appetite, reviewing the eåectiveness of our legal and compliance process and monitoring its implementation, and reviewing and approving credit decisions in excess of the credit authorization limits granted to our President. Our risk policy committee consists of Messrs. Anthony Neoh, Zhang Jinghua, Zhang Xinze, Hua Qingshan and Patrick de Saint-Aignan, with Mr. Anthony Neoh acting as the chairman. Our President or Chief Credit OÇcer (when authorized by our President) attends and reports to the risk policy committee. The risk policy committee is supported by the risk management department. Senior Management and Special Management Committees Our senior management has overall management responsibility for managing all aspects of our risk, including implementing our risk management strategies and initiatives and credit policies and approving internal rules, measures and procedures related to risk management. Our President organizes Presidents' meetings with our Vice Presidents, Assistant Presidents and Chief Credit OÇcer. During these meetings, management decisions, including those relating to risk management, are made. Decisions with respect to management decisions that fall outside the authority of the senior management will be proposed to the Board of Directors. As part of our eåorts to strengthen our risk management function, we established the Chief Credit OÇcer position in Our Chief Credit OÇcer, in conjunction with other members of senior management, supervises the risk management department and credit administration department. Our Chief Credit OÇcer is nominated by, and reports directly to, our President and is appointed by the Board of Directors. In April 2006, Lonnie Dounn tendered his resignation from our bank, eåective in September We are currently seeking a replacement for Mr. Dounn as our Chief Credit OÇcer. We have also established the following special management committees with direct risk management responsibilities: the internal control committee, the asset-liability management committee, the asset disposal committee and the anti-money laundering working committee. The internal control committee was established in March 2005, and oversees the overall internal controls in our organization, determines the basic system for internal controls, evaluates the eåectiveness of the internal control system and oversees actions taken to remedy deñciencies that have been identiñed in the internal control system. In particular, the internal control committee reviews and approves our major internal control policies and related implementation plans and establishes management and reporting systems in connection with identifying, assessing, monitoring, controlling, mitigating and quantifying operational risks. Furthermore, the internal control committee engages in-house or external experts from time to time to evaluate the eåectiveness of internal controls and provide recommendations for improvements. The internal control committee consists of Messrs. Li Lihui, Zhou Zaiqun, Zhang Lin, Zhu Min, Zhu Xinqiang, Wang Yongli and, until the eåectiveness of his resignation, Lonnie Dounn, with Mr. Li Lihui acting as the chairman. The internal control committee is supported by the legal and compliance department. The asset-liability management committee oversees the management of our overall assets and liabilities, in particular, our liquidity and market risks, and develops the relevant management policies in accordance with the general risk management policies adopted by the risk policy committee. In addition, since October 2005, the responsibilities of the asset-liability management 170

5 committee have been further clariñed to include overseeing the composition of assets and liabilities on our balance sheet, business planning and capital planning. See "" Liquidity Risk Management'' and "" Market Risk Management''. The asset-liability management committee consists of Messrs. Li Lihui, Zhou Zaiqun, Lonnie Dounn (until the eåectiveness of his resignation), and the general manager of each of the following departments: the asset-liability management department, accounting department, risk management department, Ñnancial institutions department, global markets department, corporate banking department, personal banking department and banking department. The asset and liability management committee is supported by the asset-liability management department. The asset disposal committee reviews our strategies and policies relating to the disposal of non-performing loans, and is responsible for approving the proposals of the disposition, collection and recovery of non-performing loans with amounts in excess of the authorization limits of the domestic tier one branches and overseas branches. The asset disposal committee also evaluates write-oås of non-performing loans and disposition of other assets. The asset disposal committee consists of Mr. Zhou Zaiqun, acting as the chairman, and participating members, mainly deputy general managers and heads of divisions of our credit administration, internal audit and inspection, accounting, overseas business management, risk management, global trade services, corporate banking, personal banking and legal and compliance departments at our head oçce. The asset disposal committee is supported by the credit administration department. For a description of the functions of our anti-money laundering working committee, see "" Anti-Money Laundering and Combating Financing of Terrorism Measures''. The anti-money laundering working committee is supported by the legal and compliance department. Risk Management Department The risk management department develops risk management strategies and working plans, and coordinates the development and management of risk management policies and procedures. In particular, the risk management department manages the credit risk of our businesses, formulates policies and procedures in credit authorization management and supervises their implementation, and coordinates in the implementation of the customer credit ratings and loan classiñcations. The risk management department is also responsible for the due diligence and credit review of loan applications exceeding certain credit authorization limits and submitting these loan applications for further review and approval by authorized personnel. Moreover, the risk management department monitors the credit asset quality of our bank, and collects information and reports on our exposure to credit risk and the status of the risk management of our bank. To strengthen the independence of our market risk management function in accordance with CBRC rules and regulations, we are in the process of establishing a unit within our risk management department to be responsible for formulating market risk management policies and procedures and overseeing their implementation. Asset-Liability Management Department The asset-liability management department manages our liquidity in accordance with the policies developed by the asset-liability management committee, develops projections on our liquidity needs and risks, and re-allocates funds internally to satisfy our liquidity requirements. In addition, the asset-liability management department works closely with the global markets department in executing our market risk management policy directives established by the risk policy committee, and manages the interest rate risk for our banking book and the exchange rate risk of our non-trading books. 171

6 Credit Administration Department The credit administration department was established in November 2004 to oversee loan disbursements, monitor outstanding loans, evaluate collateral and foreclosed assets, manage credit Ñles, maintain customer information and recover and write oå non-performing assets. Legal and Compliance Department The legal and compliance department is responsible for managing the legal and compliance risk and coordinating internal controls. The legal and compliance department designs and implements our legal and compliance procedures, and identiñes, evaluates and monitors our legal and compliance risk, which primarily relates to non-compliance with the relevant laws, rules and regulations, including applicable anti-money laundering regulations. The legal and compliance department also oversees and coordinates operational risk management within our bank, and is responsible for drafting operational risk management policies for identifying, assessing and monitoring operational risk and coordinating and overseeing their implementation. In addition, the legal and compliance department assists the internal control committee in supervising the implementation of our internal control system, drafting major internal control policies and related implementation plans. Furthermore, the legal and compliance department provides overall guidance for the implementation of our internal control policies and plans by our business departments and branches. Risk Management at Business Departments, Branches and Subsidiaries As part of our ongoing eåorts to improve our overall risk management, as well as streamline and enhance risk monitoring and controls at our branches and subsidiaries, our head oçce has implemented the risk management initiatives set forth below. Business Department Risk Management Special risk management teams have been established at certain business departments to monitor and control risks. In particular, under the guidance of the risk management department at our head oçce, these teams develop detailed rules, procedures and measures tailored to the operations of the relevant business department and monitor their implementation. In addition to reporting to the general manager in charge of the relevant business department, these teams are required to report to the risk management department at our head oçce for credit risk and market risk-related matters. Furthermore, business departments are required to establish adequate procedures to manage their operational risk and collect related information, as well as report such information to the legal and compliance department. Branch Risk Management Our head oçce has overall oversight of our branch risk management. In particular, the risk management departments of our domestic tier one branches are currently supervised by the risk management department at our head oçce, report both to the risk management department at our head oçce and the branch general manager. The appointment of the general managers of the risk management departments at domestic tier one branches must be conñrmed by the risk management department at our head oçce. Each domestic tier one branch directly monitors and controls the risk management of its subordinate branches. In addition, we are in the process of identifying chief credit oçcers for our domestic tier one branches, who will be primarily responsible for credit risk management and credit administration as well as independently approving loans within the authorization limits granted by the head oçce. 172

7 Each such chief credit oçcer candidate must be approved by our senior management at the head oçce. The branch general manager is directly responsible for the internal control system at the branch. Since 2005, we have established internal control committees at our domestic tier one branches that are responsible for establishing management and reporting systems in connection with identifying, monitoring, mitigating and quantifying operational risks and overseeing, evaluating the eåectiveness of internal control systems and taking remedial actions to address any deñciencies. In addition, the legal and compliance departments at these domestic tier one branches are responsible for overseeing and coordinating operational risk and the implementation of the internal control system at the branches, as well as reporting to the legal and compliance department at our head oçce. Our head oçce also oversees the risk management of our overseas branches. In particular, any credit application at the overseas branches exceeding the authorization limits is required to be submitted to the head oçce for approval. Overseas branches with a signiñcant loan business, such as our branches in Macau or London, are required to follow our ""three-in-one'' credit approval procedures for corporate loans. The overseas branches are also required to classify their loans in accordance with the standards established by our head oçce unless the relevant overseas standards are more stringent, in which case the relevant overseas standards are followed. In addition, the overseas branches are required to Ñle reports with our head oçce on any new nonperforming loans exceeding certain thresholds and any loan classiñcation upgrade from nonperforming to ""pass'' or ""special-mention''. The head oçce may also re-classify any loan that has been wrongly classiñed. Our head oçce guides and supervises the control of the asset quality of our overseas branches, periodically analyzes the asset quality and takes appropriate measures when any unusual change occurs in the asset quality of our overseas branches. Subsidiary Risk Management We currently monitor and control the risk management at our subsidiaries by appointing certain members of the boards of directors or risk management committees of the subsidiaries. These appointees are responsible for implementing the risk management initiatives and requirements formulated by our head oçce. For example, as of the date of this prospectus, Ñve of BOCHK's directors and two of four members of its risk committee are members of our Board of Directors or senior management. See also "" Risk Management of BOCHK''. CREDIT RISK MANAGEMENT Credit risk is the risk that a customer or counterparty may be unable or unwilling to meet an obligation that it has entered into with us. We are exposed to credit risk primarily through our loan portfolio, investment portfolio, guarantees and commitments, and other on- and oå-balance sheet credit exposures. In order to manage our exposure to credit risk, we have adopted credit approval policies and procedures that are reviewed and updated by the risk management department at our head oçce in conjunction with other relevant departments. The credit approval process for both corporate loans and personal loans can be broadly divided into three stages: (1) credit origination and assessment; (2) credit review and approval; and (3) fund disbursement and post-disbursement management. Credit Risk Management for Corporate Loans As part of our ongoing eåorts to develop a centralized system of approving credit applications, we began implementing in 2000 a ""three-in-one'' credit approval process for corporate loans, which 173

8 consists of the following credit approval procedures with clearly deñned credit risk management responsibilities and accountability assigned at each level: (1) an independent due diligence investigation; (2) an assessment of credit applications by an independent credit review committee; and (3) Ñnal credit extension decision to be made by authorized credit application approvers. We also evaluate the eåectiveness of this credit approval process on an ongoing basis. Credit Origination and Assessment Credit Origination The relationship managers at our corporate banking department initiate the corporate credit approval process by either interviewing credit applicants who approach us or by proactively soliciting prospective borrowers. We solicit prospective customers that we believe present low credit risk primarily based on our assessment of the economic condition and prospects of the industries or regions within which the prospective customers operate. If an applicant passes a preliminary screening by the relationship managers, it is generally required to Ñle a formal credit application with applicable supporting documents, including organizational documents, audited Ñnancial statements for the most recent three years and material contracts. The relationship managers are responsible for compiling all information required for assessing the relevant credit risk, performing a preliminary assessment and analysis on credit applications based on preestablished guidelines and preparing a preliminary evaluation report. Credit Assessment As part of our loan approval process, we assess the credit risk of loan applications submitted by corporate borrowers. The result of our credit risk assessment is a critical factor in determining whether the loan application is approved. Our analysis of the credit risk associated with corporate borrowers focuses on a number of factors, including: the probability of default by the borrower; the borrower's Ñnancial position, including an analysis of the borrower's Ñnancial statements and expected cash Öow; the quality of the borrower's business, including its history and current market position; the strength of the borrower's management; the business and Ñnancial relationships between the borrower and its parent or açliated companies; the borrower's guarantor and any collateral coverage; the purpose and structure of the loan; and the borrower's credit history and its repayment ability, including, any credit information provided by the PBOC's credit information database. In addition, we assess the industry risks associated with the corporate borrower by considering a number of factors, including: industry characteristics, such as the importance of the industry to the economy, its growth outlook and cyclical nature, as well as government policies relating to the industry; the competitiveness of the industry; and 174

9 Ñnancial and operating information relating to the industry, including return on capital, operating margins and earnings stability. Credit Rating We began using a ten-category customer credit rating system in 1999 to improve our ability to identify and assess credit risk. Our ten-category customer credit rating system is based on an analysis of various criteria and indicators of creditworthiness. The following table illustrates the credit risk ratings of our corporate customers that are rated under this system: Credit Rating AAA AA A BBB BB B CCC CC C D Credit ProÑle Ó borrowers with good Ó borrowers with Ó borrowers with Ó borrowers with credit relatively good credit relatively weak credit weak credit Ó good Ñnancial and Ó projected cash Öow Ó weak Ñnancial and Ó signiñcant risk operating condition considered together operating condition of default Ó strong ability to repay with existing assets Ó relatively signiñcant Ó low risk of default and liabilities expected to be risk of default suçcient for repayment Ó relatively low risk of default The credit rating of a corporate customer is subject to an annual review, and may be revised when there are signiñcant changes to the customer's Ñnancial condition and business operations, including expected cash Öows, its performance of existing obligations, or the quality of its Ñnancial reporting. We generally do not conduct any internal credit rating for a corporate customer that is a Ñnancial institution or governmental agency. Any assignment of a ""B'' or higher credit rating at our domestic tier one branches is required to be reviewed and approved by the risk management department at our head oçce. In addition, any assignment of a ""B'' or higher credit rating at our branches below tier one branches is required to be approved by the risk management department at the tier one branch responsible for overseeing such other branches. Branches below tier two branches do not have authority to approve any assignment of credit rating for corporate customers. As of December 31, 2005, borrowers with a credit rating of ""A'' or higher under our tencategory customer credit rating system accounted for approximately 20.3% of our total rated corporate borrowers, while the outstanding loans extended to these borrowers accounted for approximately 41.9% of our total loans outstanding of the rated corporate borrowers as of the same date. As of December 31, 2005, borrowers with a credit rating of ""B'' or higher under our tencategory customer credit rating system accounted for approximately 77.4% of our total rated corporate borrowers, and the outstanding loans extended to these borrowers accounted for approximately 88.9% of the total loans outstanding of the rated corporate borrowers as of the same date. We are in the process of developing a new statistically-based corporate borrower rating model, which we intend to introduce in This new rating model will focus on the probability of default by a borrower. We also intend to develop the capability to back-test the performance of our credit rating model in order to validate its accuracy and eåectiveness, as well as improve its performance. 175

10 Collateral Appraisal As a general matter, the value of collateral for a new loan is determined by an independent appraiser at the time of loan origination. Collateralized loans are subject to loan-to-value ratio limits, based on the type of collateral, as follows: Type of Collateral Maximum loan-to-value ratio Cash deposits with us ÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏ 90% PRC treasury bondsïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïï 90% PRC Ñnancial institution bonds ÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏ 85% Publicly traded stocks ÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏ 60% Rights to collect fees or operateïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïïï 50% Fixed assets ÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏ 70% Land use rights ÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏ 60% Vehicles ÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏÏ 70% For loans guaranteed by a third party guarantor, the guarantor's Ñnancial condition, credit history and ability to meet its obligations are evaluated according to the same procedures and criteria used for the primary obligor. Credit Review and Approval Due Diligence We have due diligence teams at both our head oçce and domestic tier one branches, which consist of staå from the risk management departments. Due diligence on loan applications is conducted by the due diligence team that is separate and diåerent from the loan origination team. The due diligence teams are responsible for analyzing and recommending measures for mitigating risks relating to potential borrowers and their credit applications. The due diligence teams submit due diligence reports, which will include their analysis of the risk proñle of, recommendations for further risk mitigation on and initial conclusion on the potential loan, directly to the credit review committees. Credit Review As part of our ongoing eåorts to promote and develop a rigorous credit extension process, we have established credit review committees at our head oçce and domestic tier one branches. These credit review committees consist of authorized credit reviewers who independently assess the credit applications and make recommendations regarding the credit applications to the authorized credit application approvers. Any recommendation to accept a credit application by the credit review committee must be approved by a simple majority of those present at the review meeting. The credit review committees review credit applications to assess whether they comply with relevant laws, rules and regulations, are consistent with our business strategies and credit policies and meet our risk management criteria. The credit review committees also review the actions proposed by the due diligence teams to mitigate identiñed risks. In the past, qualiñed personnel from various business departments were selected to serve on a part-time basis on the credit review committees. In 2004, we began requiring all credit reviewers to undergo a standardized qualiñcation review and veriñcation process established by the risk management department of our head oçce. Furthermore, we began assigning qualiñed credit reviewers to serve on a full-time basis on the credit review committees. 176

11 As of December 31, 2005, we had approximately 30 authorized credit reviewers at our head oçce and over nine authorized credit reviewers at each domestic tier one branch. The credit review committee at our head oçce holds meetings at least three times a week, while the credit review committees at our domestic tier one branches generally hold meetings at least once a week. A quorum of the credit review committee at our head oçce and domestic tier one branches requires nine and Ñve credit reviewers, respectively. Credit Approval All credit applications for our corporate lending must be approved by the authorized credit application approvers at our domestic tier one branches and head oçce, except for credit applications that are identiñed as low risk, such as loans suçciently secured by PRC treasury bonds, bills or pledged funds as collateral or loans supported by the credit of Ñnancial institutions that are within pre-approved credit limits. Authorized credit application approvers make Ñnal decisions regarding loan applications based on the uniform standards set by our head oçce, after taking into account the reports from the business department and the due diligence team and the recommendations of the credit review committee. Authorized credit application approvers are independent of the credit review committee as well as the relationship oçcers at our business departments, and they may overrule any application recommended by the credit review committee. However, authorized credit application approvers may not approve any application rejected by the credit review committee. Each authorized credit application approver may approve loan applications within their credit authorization limits set by our head oçce. The credit approval authority delegated by our head oçce varies according to the particular approver's background, including his or her industry experience, qualiñcation and quality of work and the type of customer, including its credit rating and the type of loan, and is subject to review and adjustment by our head oçce. The general managers of tier one branches may veto any loan application approved by the authorized credit application approvers at the relevant branches. Any loans exceeding the highest limit of the authorized credit application approvers at the tier one branches are required to be submitted to the risk management department at our head oçce, and are then approved by the authorized credit application approvers at the head oçces in accordance with their authorization limits. To further improve the quality of our credit approval procedure, we began in 2005 requiring credit application approvers at our domestic tier one branches to pass the relevant qualiñcation tests conducted by the risk management department at our head oçce. In addition, these approvers must be appointed by our head oçce. We plan to require credit application approvers at all of our domestic tier one branches be so qualiñed and appointed by the end of We are also in the process of identifying chief credit oçcers at our domestic tier one branches, who will also function as authorized credit approvers with the highest credit authorization limits at the respective branches. Approval VeriÑcation We implemented in 2004 a credit approval veriñcation system at our head oçce to enhance our compliance with our credit policies at our domestic branches. Under this system, after a corporate loan application at our domestic branches has been approved, it is transmitted to the risk management department at our head oçce where a specialized team veriñes, analyzes and monitors these applications for discrepancies or non-compliance with the required procedures or credit policies in a centralized manner. Generally, the Ñndings are communicated to the relevant branch within one business day. 177

12 Fund Disbursement and Post-Disbursement Management Fund Disbursement The credit administration departments at our head oçce and tier one branches have implemented controls at all of our tier one domestic branches and certain tier two domestic branches aimed at ensuring that funds are properly disbursed only after all conditions for disbursement have been satisñed. Under this system, the credit administration department will deliver a disbursement notice authorizing the release of funds only after all conditions have been satisñed. Failure to satisfy all conditions will result in the loan application either being returned to the corporate banking department for further action or to the risk management department for further review. Ongoing Credit Monitoring Loan monitoring is an integral part of our credit risk management. We monitor both the performance of individual loans as well as our overall loan portfolio. The corporate banking, risk management and credit administration departments are the principal departments involved in our loan monitoring eåorts. Among these three departments, risk management departments also oversee the loan monitoring and management activities undertaken by the credit administration departments and corporate banking departments. In the process of credit monitoring, we check each borrower's ongoing compliance with credit terms, maintain regular contact with borrowers through on-site visits and meetings, and promptly follow up on documentation deñciencies to ensure that we have current information regarding each borrower's Ñnancial position, as well as the performance and repayment status of each of our loans, and that early indicators of delinquency are detected to facilitate prompt remedial action. We further enhanced the implementation of the credit monitoring process in 2005 and intend to continue enhancing this credit monitoring process, as well as recruiting additional staå to support the process. The relationship managers at the corporate banking department function as the primary contact points with our borrowers, and we have recently established special post-disbursement loan management teams within the corporate banking departments to increase the monitoring of our corporate loans. Loan classiñcation is an important part of our ongoing loan monitoring. Beginning in the second quarter of 2005, we have centralized the responsibility for approving loan classiñcations to our head oçce and domestic tier one branches as well as increased the level of oversight of these decisions by our head oçce. Currently, our head oçce approves the classiñcation of approximately 80% of our total outstanding corporate loans of our domestic operations. The loan classiñcations are generally reviewed semi-annually and may be adjusted as required. See ""Description of Our Assets and Liabilities Assets Loan Quality Loan ClassiÑcation''. We have set up collateral management teams within our credit administration departments. We have recently commenced formalizing and improving our collateral management process and system, enhancing the management of third-party appraisal service providers, implementing internal valuation and review of collateral, and improving the documentation of collateral. In the event we detect signs of delinquency, we will conduct a more detailed review of the credit risk and repayment ability of the borrower concerned, as well as take appropriate remedial measures. Outstanding loans that have been identiñed as higher risk loans, are generally required to 178

13 be managed by the credit administration department. These loans include loans from the following types of borrowers: borrowers who are not eligible for credit extensions under our risk policies or guidelines; borrowers whose substandard loans have not been restructured within 180 days since their loans have been initially classiñed as substandard and who continue to have substandard loans outstanding; borrowers whose substandard loans have been restructured, but who continue to have substandard loans outstanding after one year or two payment periods; and borrowers who have doubtful or loss loans outstanding. In addition, we also monitor the overall quality of our loan portfolio, and regularly monitor the risk and return of our loan portfolio. In particular, we provide guidelines on our credit approval policies in terms of industry, type of customers, type of products and geographic area. Risk Alerts We have initiated various risk alert systems for early detection and mitigation of credit risk. For example, under our major risk event reporting system, the risk management departments at our branches are required to immediately report any major risk event to the risk management department at our head oçce. We employ risk alert tools, including industry or geography risk monitoring reports, Ñnancial alert reports and customer risk reports, to monitor our risk. Our risk-monitoring staå at the head oçce monitors and analyzes such reports and, if necessary, the risk management department at our head oçce issues risk alerts to our branches and provides instructions on remedial measures. The relationship managers at our corporate banking departments are required to take remedial measures based on such risk alerts if warranted. Furthermore, our head oçce uses the information derived from these sources to develop high-risk customer databases and watch-lists, and our branches are required to report to the head oçce any changes in the Ñnancial condition and related information of these borrowers, as well as our outstanding credit exposure. Special-Mention Loan Management Since 2005, we have taken additional measures to improve our management of special-mention loans. In particular, we have established a database to monitor the special-mention loans of our domestic branches, including by compiling case proñles of certain special-mention loans to facilitate our analysis of the movements of special-mention loans and our further classiñcation of these loans. The risk management department at our head oçce currently monitors the movements and deterioration of our special-mention loan portfolio on a monthly basis and reports to the senior management. At the same time, our corporate banking department also increased its management of the special-mention loans by requiring the relationship managers to take necessary actions whenever potential credit deterioration is detected. Based on the Ñnancial condition and the internal credit rating of the borrower, as well as the overdue days of the loans, we have further classiñed special-mention loans into three categories for further action: low risk special-mention loans: continue to monitor the total outstanding amount of these loans; medium risk special-mention loans: risk mitigating actions to be taken; and 179

14 high risk special-mention loans: prompt action to be taken, with the speciñc action varying on a case-by-case basis. As part of these ongoing eåorts, we reviewed certain of our special-mention loans during the third quarter of We have taken speciñc actions for the high risk special-mention loans identiñed during this review, including: (1) amendments to the terms of the loan, such as increased pricing; (2) reduction of a borrower's credit limit; (3) requests for additional security, primarily in the form of collateral; and (4) loan downgrades. Non-Performing Loan Management and Recovery Our credit administration departments work closely with managers and risk management departments at the branch level in connection with the management and recovery of non-performing loans. We also retain external legal advisors, accountants and specialized agents to expedite resolution of non-performing loans. The asset disposal teams within our credit administration departments initiate and design asset disposal plans. Our due diligence teams review these plans and issue due diligence reports based on their due diligence results. The asset disposal plans and due diligence reports are then submitted to the asset disposal committee at our branches for approval or to the asset disposal committee at our head oçce if the amount involved exceeds the authorization limits of our branches. The chairmen of our asset disposal committees at our head oçce and the branch level, as the case may be, will make the Ñnal approval regarding the proposed asset disposal plans. Our primary recovery methods include demand for payment, negotiated settlement, legal proceedings, realization of collateral and restructuring. To the extent that amounts cannot be recovered after we have exhausted all legal and non-legal procedures, these unrecoverable amounts will be written oå. Demand for payment. As an initial step in our collection eåorts, a demand for payment will be sent to borrowers on a regular basis. These payment demands are not only a part of our collection eåorts, but also help us gather information about the current status of the borrower's business and Ñnancial condition. Depending on the level of cooperation from the borrower, we may either pursue legal proceedings or negotiate with the borrower to resolve the non-performing loan. Negotiated settlements. Our domestic operations may enter into negotiated settlements to permit borrowers to settle their liabilities without paying the full amount of the interest due, and our overseas operations may permit borrowers to settle their liabilities without paying the full amount of the principal and interest due. A negotiated settlement often takes the form of a restructuring, pursuant to which we may require additional collateral or guarantees. When we have made a determination that a borrower's Ñnancial condition is unlikely to improve and that the chances of repayment are remote, a negotiated settlement generally includes partial payment as well as the realization of collateral. Legal proceedings. We may initiate legal proceedings to recover a non-performing loan when the borrower does not cooperate with us in our collection eåorts or demonstrates no intention of repaying the loan, or when the Ñnancial condition of the borrower deteriorates to the extent that our ability to collect may be endangered if we do not take appropriate action quickly. Upon obtaining a court judgment, we may: (1) accept installment payments from the borrower and/or guarantor; (2) foreclose on the properties (including collateral, if any) of the borrower and/or guarantor; or (3) work with the borrower and/or guarantor to restructure the non-performing loan under the court's supervision, as applicable. 180

15 Realization of collateral. We may realize collateral as the result of a negotiated settlement or a legal proceeding with judicial enforcement. We may sell, upon authorization by the borrower or the competent court, any collateral through public auctions or negotiated sales to maximize recovery. However, we may face diçculties in enforcing our rights as a secured creditor. In particular, in certain areas in the PRC, deñciencies regarding the enforcement of legal proceedings and local protectionism may make it diçcult for us to implement foreclosures and enforce judgments, which may result in losses to us. Restructuring. Restructuring is a voluntary or, to a limited extent, court-supervised procedure, through which we and a borrower and/or its guarantor, if any, restructure credit terms generally as a result of deterioration in the borrower's Ñnancial condition or of the borrower's inability to make payments when due. We will restructure a non-performing loan only if the borrower's business has good prospects. In addition, prior to approving the restructuring of loans, we typically require additional guarantees, pledges and/or collateral, or the assumption of the loan by a borrower with better repayment ability. We classify all restructured loans as ""substandard'' or below. If the restructured loans fall overdue or if the borrower is still unable to demonstrate its repayment ability, these loans will be reclassiñed to ""doubtful'' or below. All restructured loans are subject to a surveillance period up to one year. During the surveillance period, restructured loans remain as nonperforming loans, and we closely monitor the borrower's business operations and loan repayment patterns. After the surveillance period, restructured loans may be upgraded to ""special-mention'' upon review if certain criteria are met. Write-oÅ. We write oå a non-performing loan only after we have exhausted all collection eåorts and taken all available legal remedies. A loan write-oå requires the approval of the credit administration department and Ñnance department and must be reviewed by the asset disposal committee at our head oçce or domestic tier one branches, as applicable. The asset disposal committee is responsible for reviewing the write-oås of credit and non-credit assets and the chairman of the asset disposal committee is responsible for approving write-oås. Loan write-oås exceeding certain thresholds are required to be approved by our head oçce. Credit Risk Management Information Technology We rely on our credit management information system as the primary data source for conducting credit analysis and reporting on our loan portfolio. In addition, we utilize an asset quality monitoring system that helps us collect and analyze data and monitor our credit risk. We have also acquired various information technologies to enhance our credit risk management and are in the process of further improving our current information technology system. We expect the combination of these systems will help enhance our ability to assess the credit of our corporate customers based on qualitative and quantitative measures and monitor the quality of our loan portfolio. Credit Management Information System We launched our credit management information system in 2002 to monitor our domestic corporate lending. Our credit management information system collects information on customers, loan agreements, risk classiñcation and accounting treatment, and is our primary data source for credit and related analysis. Our credit management information system also serves as the foundation for our portfolio management, risk monitoring and risk alert system. Asset Quality Monitoring System We commenced implementing our asset quality monitoring system in 2004, and have completed the implementation of this system in all of our domestic branches. The asset quality monitoring 181